反调试方法二 - 抢占ptrace

The ptrace() system call provides a means by which one process (the"tracer") may observe and control the execution of another process(the "tracee"), and examine and change the tracee's memory andregisters. It is primarily used to implement breakpoint debugging and system call tracing.

帮助文档online.

ptrace

ptrace可以让一个进程监视和控制另一个进程的执行,并且修改被监视进程的内存、寄存器等,主要应用于断点调试和系统调用跟踪.

函数原型: long ptrace(int request, pid_t pid, void * addr, void * data)